View online: https://www.drupal.org/sa-contrib-2021-036
Project: SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider [1] Date: 2021-September-22 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Multiple vulnerabilities
Description: This module provides a solution to authenticate visitors using existing SAML providers.
Certain non-default configurations allow a malicious user to login as any chosen user.
The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate".
Solution: Ensure that the "Either SAML response or SAML assertion must be signed" and "x509 certificate" options on the dedicated plugin page are both enabled.
Install the latest version:
* If you use the SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider module for Drupal 8.x or 9.x, upgrade to SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 8.x-2.24 [3] * If you use the SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider module for Drupal 7.x, upgrade to SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 7.x-2.57 [4]
Reported By: * Cristian 'void' Giustini [5]
Fixed By: * Cristian 'void' Giustini [6] * abhay19 [7]
Coordinated By: * Damien McKenna [8] of the Drupal Security Team
[1] https://www.drupal.org/project/miniorange_saml [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_saml/releases/8.x-2.24 [4] https://www.drupal.org/project/miniorange_saml/releases/7.x-2.60 [5] https://www.drupal.org/user/3680969 [6] https://www.drupal.org/user/3680969 [7] https://www.drupal.org/user/3549350 [8] https://www.drupal.org/u/damienmckenna